SolarWinds Serv-U LDAP Authentication Input Validation Vulnerability (CVE-2021-35247) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTSolarWinds Serv-U versions prior to 15.3 utilizing LDAP authentication
Attackers can input unsanitized characters to manipulate LDAP queries, potentially leading to authentication bypass attempts or directory harvesting, with active exploitation confirmed via CISA KEV
Immediately upgrade SolarWinds Serv-U to version 15.3 or later, and apply WAF rules to filter out LDAP special characters from login inputs
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
SolarWinds recommends upgrading Serv-U to the latest secure release (15.3 or higher). For Linux-based deployments, use the following commands to perform the upgrade:
# 1. Stop the running Serv-U service
sudo systemctl stop Serv-U
# 2. Extract the latest secure installer package (downloaded from SolarWinds Customer Portal)
tar -zxvf Serv-U-15.3-Linux.tar.gz
# 3. Run the installation script and restart the service
sudo ./install.sh
sudo systemctl start Serv-U2. Temporary Workaround & Hardening Configuration
If an immediate patch cannot be applied, configure a reverse proxy or Web Application Firewall (WAF) to block requests containing LDAP injection characters.
# Nginx configuration snippet to block LDAP injection characters in URI/Requests
server {
listen 80;
server_name servu.example.com;
location / {
# Block requests containing common LDAP injection characters
if ($request_uri ~* '[\*\(\)\|\&]') {
return 403 'Request blocked due to invalid characters';
}
proxy_pass http://backend_servu_ip:8080;
}
}3. Log Audit & IoC Verification Commands
Inspect the Serv-U login logs for any suspicious characters that indicate active scanning or exploitation attempts.
# Search for LDAP injection patterns in the Serv-U log file
grep -E '(\*|\(|\)|\&|\|)' /usr/local/Serv-U/Logs/Serv-U.log
# Verify the currently installed Serv-U binary version
/usr/local/Serv-U/Serv-U -versionBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-35247) exists in the SolarWinds Serv-U web login screen during LDAP authentication. The root cause is insufficient input validation and sanitization (CWE-20) of user-supplied input before it is passed to the backend LDAP directory server. This allows malicious actors to inject special characters that can alter the structure of the constructed LDAP query.
2. Exploitation Mechanics & Attack Scenario
An attacker targets the publicly accessible Serv-U web login interface. By injecting LDAP filter control characters (such as *, (, ), &, |) into the username or login fields, the attacker attempts to manipulate the query logic executed by the LDAP server. Although SolarWinds noted that downstream LDAP servers generally ignored these improper characters—resulting in no detected downstream compromise—the lack of sanitization poses a significant risk. Because this vulnerability is listed in the CISA KEV catalog, it has been actively targeted by threat actors seeking to exploit internet-facing file transfer portals.
3. Infrastructure & Business Impact
As Serv-U is commonly deployed at the perimeter to facilitate secure file transfers, any vulnerability in its authentication mechanism poses a high risk to enterprise data integrity. Successful exploitation attempts, even if ignored by the LDAP server, can lead to authentication service degradation, log flooding, and potential security monitoring bypasses, undermining the overall trust in the external-facing infrastructure.
Official Vendor Advisories & References
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Frequently Asked SecOps Questions (CVE-2021-35247)
FAQQ1. How critical is CVE-2021-35247 and is it actively exploited in the wild?
CVE-2021-35247 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 3.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-35247?
Primary impacted vendors include solarwinds across serv-u. Scope summary: All SolarWinds Serv-U versions prior to 15.3
Q3. What temporary mitigations or workarounds exist for CVE-2021-35247 before patching?
[Mitigation] Immediately upgrade SolarWinds Serv-U to version 15.3 or later, and apply WAF rules to filter out LDAP special characters from login inputs Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-35247
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (solarwinds)
View Category →SolarWinds Serv-U Unauthenticated Remote Denial of Service (DoS) Vulnerability (CVE-2026-28318) Analysis and Mitigation Guide
[Affected Scope] SolarWinds Serv-U file transfer server versions prior to 15.5.4 Hotfix 1
PTC Windchill and FlexPLM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-12569)
[Affected Scope] All versions of PTC Windchill PDMlink and FlexPLM prior to 11.0 M030, including all CPS releases.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Microsoft SharePoint Spoofing Vulnerability due to Improper Input Validation (CVE-2026-32201)
[Affected Scope] Microsoft SharePoint Server deployments
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.